Privacy Policy

Study Grounded (“we”, “us”) is a study assistant that answers questions and builds study aids from material you upload. Study Grounded is operated by Voterm, a South African company that is the responsible party for the personal information described here and serves as our Information Officer. To reach us, email isaacgumbi@gmail.com. A plain-language summary lives on our Trust & data page.

• Account: your email address, authentication state, and profile-level account settings.
• Study material you upload: PDFs, photos and images, typed notes, web links, lecture audio, extracted text, embeddings used for search, folders, and AI-suggested resource categories.
• What you create and ask:questions, AI answers, saved study guides, summaries, practice quizzes, quiz scores, flashcards, spaced-repetition review cards, study focus, answer mode, and messages to the in-app study assistant (“Pip”).
• Sharing and organizations: shared library memberships, organization memberships, cohorts/groups, invitations, organization-assigned materials, notes, quizzes, audit logs, and organization-scoped scores or progress.
• Billing and API access: subscription status, payment-provider identifiers, agent/API keys, usage counters, and security logs needed to operate paid bot or agent access. We never store full card numbers.
• Usage and technical data: quota counters, token totals, upload bytes, query counts, rate-limit logs, basic device/log data, Vercel Web Analytics and Speed Insights aggregates, and error diagnostics.

We use your information only to run, secure, and improve the service, specifically to:

• index your material and answer your questions from it, with citations;
• generate study guides, quizzes, flashcards, transcriptions, OCR, and folder suggestions;
• run Pip, Tutor mode, spaced-repetition review, and learner progress features;
• support organization workspaces, cohort assignment, and educator/admin controls;
• enforce quotas, rate limits, payment checks, and bot/API access rules;
• process subscriptions, provide support, monitor reliability, and prevent abuse.

We do not sell your data, show advertising, or use cross-site tracking.

We use trusted service providers that process data on our behalf and are not permitted to use it for their own purposes:

• Supabase for database, file storage, and authentication.
• Vercel for hosting, web analytics, speed insights, and delivery.
• AI model providers, including DeepSeek and Google Gemini, and where enabled OpenAI and Anthropic, receive your question and relevant passages of your material to generate answers, guides, quizzes, flashcards, folder suggestions, and Pip replies. HuggingFace and/or Google generate embeddings used for search. Google and/or OpenAI may transcribe lecture audio or read text from images.
• Jina AI (r.jina.ai) extracts readable text from web pages you add to your library by URL.
• Stripe and PayFast for payment processing.
• Cloudflare Turnstile for sign-in bot/abuse protection when enabled.
• Resend for transactional email.
• Sentry for error monitoring.

Your personal resources and questions are scoped to your account and are not shared with other users except through sharing or organization features you use.

Some providers process data outside South Africa, for example in the European Union or the United States. Where personal information crosses borders we rely on those providers' contractual and technical safeguards, as permitted under section 72 of POPIA. By using Study Grounded you acknowledge that your content may be processed in these locations to deliver the features you use.

• Questions and answers: the most recent per account (100 on Free, 500 on Premium); older items are deleted automatically according to plan retention windows.
• Resources, study guides, flashcards, folders, review cards, and organization materials: kept until deleted by the authorized user or workspace owner.
• Rate-limit logs: short-lived and purged regularly.
• Security, audit, billing, and agent-access logs: kept only as long as needed to investigate abuse, billing disputes, unauthorized access, or legal obligations.
• Auth sessions: tokens are short-lived, refresh silently, and are cleared when you sign out.

We use essential cookies and preference storage only; no advertising or cross-site tracking cookies.

• sb-*-auth-token keeps you signed in and is removed when you sign out.
• sg-theme remembers your light/dark appearance preference.
• Cloudflare Turnstile may set a bot-check cookie on sign-in when enabled.

Local storage may remember your cookie notice acknowledgement, study focus, Pip nudge bookkeeping, and selected answer mode. Vercel Web Analytics and Speed Insights help us understand aggregate traffic and performance; they are not used to expose private study material to bots or advertisers.

Public bots and search crawlers may access public pages and documented public agent metadata endpoints within limits. They do not receive your private uploads, chunks, questions, answers, guides, quiz history, share links, organization content, or personal library content unless you explicitly authorize an authenticated integration.

Organization owners/admins can manage organization members, materials, notes, quizzes, assignments, groups, invitations, audit logs, and organization-scoped progress according to role. Educators are scoped to assigned cohorts where cohort controls are used. These roles do not grant access to your private personal library unless you explicitly share it.

Under POPIA you may access, correct, or delete your personal information, and object to processing. In the app you can delete resources, export question history, download guides, rename resources/folders, and delete your account from Account - Delete account.

For help, or to complain, email isaacgumbi@gmail.com. You may also lodge a complaint with the Information Regulator of South Africa.

Study Grounded is a study tool, not a social platform: there is no public profile, no messaging between users, and no ads. Learners under 18 should use it with a parent or guardian's consent, and a guardian may request deletion of a learner's account.

Data is encrypted in transit, access is scoped by account and role, private files are served through authenticated routes, and payment card data is handled by payment providers. No system is perfectly secure, but we work to protect your information and fix issues quickly.

We may update this policy as the product evolves. Questions about this policy, data export, or deletion can be sent to isaacgumbi@gmail.com. See also the Terms, Trust & data, and Bots & API pages.